Compare commits
7 Commits
feat/13-be
...
feat/13-be
| Author | SHA1 | Date | |
|---|---|---|---|
| 6e65738c04 | |||
| e0db3ace6e | |||
| 6f5a61dea6 | |||
| 1a6daecc47 | |||
| 08515b9bba | |||
| 69db103e0e | |||
| ffd59c0aac |
@@ -157,7 +157,7 @@ jobs:
|
||||
# Log dump must precede teardown (which removes the containers).
|
||||
- name: Dump container logs on failure
|
||||
if: failure()
|
||||
run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel 2>&1 || true
|
||||
run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service 2>&1 || true
|
||||
- name: Tear down
|
||||
if: always()
|
||||
run: make down
|
||||
|
||||
2
Makefile
2
Makefile
@@ -10,7 +10,7 @@ COMPOSE := infra/docker-compose.yml
|
||||
# Long-running services with a healthcheck — the smoke polls these for readiness
|
||||
# (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
|
||||
# are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
|
||||
WAIT_SVCS := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel
|
||||
WAIT_SVCS := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar
|
||||
# Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
|
||||
# into external named volumes via `docker cp` (infra/seed-config.sh) instead of
|
||||
# bind-mounted, because bind mounts don't reach sibling containers on the
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
# Multi-stage build for the behandel portal (Angular → nginx).
|
||||
# Build context is the repo root (the app needs the pnpm workspace + libs). See infra/docker-compose.yml.
|
||||
FROM node:24-slim AS build
|
||||
WORKDIR /src
|
||||
RUN corepack enable && corepack prepare pnpm@11.5.2 --activate
|
||||
|
||||
# Restore first (cached unless the manifests change).
|
||||
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nx.json tsconfig.base.json eslint.config.mjs ./
|
||||
RUN pnpm install --frozen-lockfile
|
||||
|
||||
# Sources (only what the app + its libs need).
|
||||
COPY apps/behandel apps/behandel
|
||||
COPY libs libs
|
||||
RUN pnpm nx build behandel
|
||||
|
||||
FROM nginx:1.27-alpine AS runtime
|
||||
COPY apps/behandel/nginx.conf /etc/nginx/conf.d/default.conf
|
||||
COPY --from=build /src/dist/apps/behandel/browser /usr/share/nginx/html
|
||||
# Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
|
||||
# service name, so the token issuer matches the BFF's medewerker authority (host-consistent, ADR-0013).
|
||||
RUN printf '{ "authority": "http://keycloak:8080/realms/medewerker" }\n' > /usr/share/nginx/html/config.json
|
||||
|
||||
EXPOSE 80
|
||||
@@ -1,34 +0,0 @@
|
||||
import nx from '@nx/eslint-plugin';
|
||||
import baseConfig from '../../eslint.config.mjs';
|
||||
|
||||
export default [
|
||||
...nx.configs['flat/angular'],
|
||||
...nx.configs['flat/angular-template'],
|
||||
...baseConfig,
|
||||
{
|
||||
files: ['**/*.ts'],
|
||||
rules: {
|
||||
'@angular-eslint/directive-selector': [
|
||||
'error',
|
||||
{
|
||||
type: 'attribute',
|
||||
prefix: 'app',
|
||||
style: 'camelCase',
|
||||
},
|
||||
],
|
||||
'@angular-eslint/component-selector': [
|
||||
'error',
|
||||
{
|
||||
type: 'element',
|
||||
prefix: 'app',
|
||||
style: 'kebab-case',
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ['**/*.html'],
|
||||
// Override or add rules here
|
||||
rules: {},
|
||||
},
|
||||
];
|
||||
@@ -1,24 +0,0 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
root /usr/share/nginx/html;
|
||||
index index.html;
|
||||
|
||||
# Resolve the BFF via Docker's embedded DNS at request time (variable proxy_pass), so nginx starts
|
||||
# even before the BFF is up and picks up restarts — instead of failing to load the config.
|
||||
resolver 127.0.0.11 ipv6=off valid=30s;
|
||||
|
||||
# Same-origin API: proxy the behandel endpoint group to the bff service. The api-client uses
|
||||
# relative URLs, so the browser calls this origin and nginx forwards to the BFF — no CORS, and the
|
||||
# medewerker token (same-origin) is attached by the app's interceptor (ADR-0013).
|
||||
location /behandel/ {
|
||||
set $bff http://bff:8080;
|
||||
proxy_pass $bff;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
# SPA fallback — Angular client-side routing.
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
}
|
||||
@@ -1,80 +0,0 @@
|
||||
{
|
||||
"name": "behandel",
|
||||
"$schema": "../../node_modules/nx/schemas/project-schema.json",
|
||||
"projectType": "application",
|
||||
"prefix": "app",
|
||||
"sourceRoot": "apps/behandel/src",
|
||||
"tags": [],
|
||||
"targets": {
|
||||
"build": {
|
||||
"executor": "@angular/build:application",
|
||||
"outputs": ["{options.outputPath}"],
|
||||
"defaultConfiguration": "production",
|
||||
"options": {
|
||||
"outputPath": "dist/apps/behandel",
|
||||
"browser": "apps/behandel/src/main.ts",
|
||||
"tsConfig": "apps/behandel/tsconfig.app.json",
|
||||
"assets": [
|
||||
{
|
||||
"glob": "**/*",
|
||||
"input": "apps/behandel/public"
|
||||
}
|
||||
],
|
||||
"styles": ["apps/behandel/src/styles.css"]
|
||||
},
|
||||
"configurations": {
|
||||
"production": {
|
||||
"budgets": [
|
||||
{
|
||||
"type": "initial",
|
||||
"maximumWarning": "1mb",
|
||||
"maximumError": "2mb"
|
||||
},
|
||||
{
|
||||
"type": "anyComponentStyle",
|
||||
"maximumWarning": "4kb",
|
||||
"maximumError": "8kb"
|
||||
}
|
||||
],
|
||||
"outputHashing": "all"
|
||||
},
|
||||
"development": {
|
||||
"optimization": false,
|
||||
"extractLicenses": false,
|
||||
"sourceMap": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"serve": {
|
||||
"continuous": true,
|
||||
"executor": "@angular/build:dev-server",
|
||||
"defaultConfiguration": "development",
|
||||
"configurations": {
|
||||
"production": {
|
||||
"buildTarget": "behandel:build:production"
|
||||
},
|
||||
"development": {
|
||||
"buildTarget": "behandel:build:development"
|
||||
}
|
||||
}
|
||||
},
|
||||
"lint": {
|
||||
"executor": "@nx/eslint:lint"
|
||||
},
|
||||
"test": {
|
||||
"executor": "@angular/build:unit-test",
|
||||
"options": {
|
||||
"watch": false
|
||||
}
|
||||
},
|
||||
"serve-static": {
|
||||
"continuous": true,
|
||||
"executor": "@nx/web:file-server",
|
||||
"options": {
|
||||
"buildTarget": "behandel:build",
|
||||
"staticFilePath": "dist/apps/behandel/browser",
|
||||
"spa": true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
{
|
||||
"authority": "http://localhost:8180/realms/medewerker"
|
||||
}
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
@@ -1,73 +0,0 @@
|
||||
import { provideHttpClient, withInterceptors } from '@angular/common/http';
|
||||
import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
|
||||
import { TestBed } from '@angular/core/testing';
|
||||
import { BffApiV1Service } from 'api-client';
|
||||
import { authInterceptor } from 'auth';
|
||||
import { AbstractSecurityStorage, ConfigurationService } from 'angular-auth-oidc-client';
|
||||
import { SECURE_API_ROUTES } from './app.config';
|
||||
|
||||
// Guards the medewerker token wiring end-to-end. The api-client calls the BFF with RELATIVE URLs, and
|
||||
// the angular-auth-oidc-client interceptor attaches the token only when `req.url` starts with a
|
||||
// configured secureRoute. A regression to an absolute origin makes the relative URL never match, so
|
||||
// the behandel calls go out unauthenticated and the BFF answers 401. This drives the REAL interceptor
|
||||
// and the REAL api-client against the REAL production route value (SECURE_API_ROUTES); only the config
|
||||
// source and token storage are faked, so the assertion turns on the actual route-matching.
|
||||
describe('behandel medewerker token wiring', () => {
|
||||
let http: HttpTestingController;
|
||||
let bff: BffApiV1Service;
|
||||
const token = 'medewerker-access-token';
|
||||
|
||||
beforeEach(() => {
|
||||
TestBed.configureTestingModule({
|
||||
providers: [
|
||||
provideHttpClient(withInterceptors([authInterceptor()])),
|
||||
provideHttpClientTesting(),
|
||||
{
|
||||
provide: ConfigurationService,
|
||||
useValue: {
|
||||
hasAtLeastOneConfig: () => true,
|
||||
getAllConfigurations: () => [{ configId: 'medewerker', secureRoutes: SECURE_API_ROUTES }],
|
||||
},
|
||||
},
|
||||
{
|
||||
// A signed-in session: the storage the interceptor's token lookup reads from.
|
||||
provide: AbstractSecurityStorage,
|
||||
useValue: {
|
||||
read: () => JSON.stringify({ authzData: token, authnResult: { id_token: 'id-token' } }),
|
||||
write: () => undefined,
|
||||
remove: () => undefined,
|
||||
clear: () => undefined,
|
||||
},
|
||||
},
|
||||
],
|
||||
});
|
||||
http = TestBed.inject(HttpTestingController);
|
||||
bff = TestBed.inject(BffApiV1Service);
|
||||
});
|
||||
|
||||
afterEach(() => http.verify());
|
||||
|
||||
it('attaches the bearer token to the relative werkbak call', () => {
|
||||
bff.getBehandelWerkbak().subscribe();
|
||||
|
||||
const req = http.expectOne('/behandel/werkbak');
|
||||
expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`);
|
||||
req.flush([]);
|
||||
});
|
||||
|
||||
it('attaches the bearer token to the relative decide call', () => {
|
||||
bff.postBehandelRegistrationsIdDecide('reg-1', { besluit: 'goedkeuren' }).subscribe();
|
||||
|
||||
const req = http.expectOne('/behandel/registrations/reg-1/decide');
|
||||
expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`);
|
||||
req.flush(null);
|
||||
});
|
||||
|
||||
it('leaves the anonymous openbaar register call unauthenticated', () => {
|
||||
bff.getOpenbaarRegister().subscribe();
|
||||
|
||||
const req = http.expectOne((r) => r.url === '/openbaar/register');
|
||||
expect(req.request.headers.has('Authorization')).toBe(false);
|
||||
req.flush([]);
|
||||
});
|
||||
});
|
||||
@@ -1,39 +0,0 @@
|
||||
import { provideHttpClient, withInterceptors } from '@angular/common/http';
|
||||
import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core';
|
||||
import { provideRouter } from '@angular/router';
|
||||
import { authInterceptor, provideMedewerkerAuth } from 'auth';
|
||||
import { appRoutes } from './app.routes';
|
||||
|
||||
/** Environment-specific settings fetched from /config.json at startup (see main.ts). */
|
||||
export interface RuntimeConfig {
|
||||
/** The Keycloak `medewerker` realm issuer as the browser reaches it (dev: localhost; compose: keycloak:8080). */
|
||||
authority: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Route prefixes whose requests carry the medewerker token. These MUST match the **relative** URLs
|
||||
* the api-client actually calls (same-origin via the nginx proxy) — the interceptor matches on
|
||||
* `req.url`, which stays relative, so an absolute origin would never match and the token would go
|
||||
* unattached. Only `/behandel/` is secured; the app calls no other endpoint group.
|
||||
*/
|
||||
export const SECURE_API_ROUTES = ['/behandel/'];
|
||||
|
||||
/**
|
||||
* Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak
|
||||
* redirects back). `secureRoutes` uses {@link SECURE_API_ROUTES} — relative prefixes, not the origin.
|
||||
*/
|
||||
export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
|
||||
const origin = typeof window !== 'undefined' ? window.location.origin : '/';
|
||||
return {
|
||||
providers: [
|
||||
provideBrowserGlobalErrorListeners(),
|
||||
provideRouter(appRoutes),
|
||||
provideHttpClient(withInterceptors([authInterceptor()])),
|
||||
provideMedewerkerAuth({
|
||||
authority: runtime.authority,
|
||||
redirectUrl: origin,
|
||||
secureRoutes: SECURE_API_ROUTES,
|
||||
}),
|
||||
],
|
||||
};
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
<router-outlet></router-outlet>
|
||||
@@ -1,7 +0,0 @@
|
||||
import { Route } from '@angular/router';
|
||||
import { authenticatedGuard } from 'auth';
|
||||
import { WerkbakPage } from './werkbak/werkbak-page';
|
||||
|
||||
export const appRoutes: Route[] = [
|
||||
{ path: '', component: WerkbakPage, canActivate: [authenticatedGuard] },
|
||||
];
|
||||
@@ -1,15 +0,0 @@
|
||||
import { provideRouter } from '@angular/router';
|
||||
import { render, screen } from '@testing-library/angular';
|
||||
import { App } from './app';
|
||||
|
||||
describe('App', () => {
|
||||
it('renders the router outlet shell', async () => {
|
||||
const { container } = await render(App, {
|
||||
providers: [provideRouter([])],
|
||||
});
|
||||
|
||||
// The shell is a thin host for routed pages (the WerkbakPage owns the heading).
|
||||
expect(container.querySelector('router-outlet')).toBeTruthy();
|
||||
expect(screen).toBeTruthy();
|
||||
});
|
||||
});
|
||||
@@ -1,12 +0,0 @@
|
||||
import { Component } from '@angular/core';
|
||||
import { RouterModule } from '@angular/router';
|
||||
|
||||
@Component({
|
||||
imports: [RouterModule],
|
||||
selector: 'app-root',
|
||||
templateUrl: './app.html',
|
||||
styleUrl: './app.css',
|
||||
})
|
||||
export class App {
|
||||
protected title = 'behandel';
|
||||
}
|
||||
@@ -1,64 +0,0 @@
|
||||
<main utrecht-document class="utrecht-theme">
|
||||
<utrecht-article>
|
||||
<utrecht-heading-1>Werkbak</utrecht-heading-1>
|
||||
<p utrecht-paragraph>
|
||||
Registraties die wachten op beoordeling. Keur elke registratie goed of wijs deze af.
|
||||
</p>
|
||||
|
||||
@if (loading()) {
|
||||
<p utrecht-paragraph role="status">Bezig met laden…</p>
|
||||
} @else if (failed()) {
|
||||
<p utrecht-paragraph role="alert">
|
||||
Kon de werkbak niet laden. Controleer of je als behandelaar bent ingelogd en probeer het
|
||||
opnieuw.
|
||||
</p>
|
||||
} @else if (loaded() && items().length === 0) {
|
||||
<p utrecht-paragraph role="status">De werkbak is leeg.</p>
|
||||
} @else if (items().length > 0) {
|
||||
<table utrecht-table>
|
||||
<caption>
|
||||
Registraties in behandeling
|
||||
</caption>
|
||||
<thead>
|
||||
<tr>
|
||||
<th scope="col">Referentie</th>
|
||||
<th scope="col">BSN</th>
|
||||
<th scope="col">Status</th>
|
||||
<th scope="col">Actie</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
@for (item of items(); track item.registrationId) {
|
||||
<tr>
|
||||
<td>{{ item.registrationId }}</td>
|
||||
<td>{{ item.bsn }}</td>
|
||||
<td>{{ item.status }}</td>
|
||||
<td>
|
||||
<button
|
||||
utrecht-button
|
||||
appearance="primary-action-button"
|
||||
type="button"
|
||||
[attr.aria-label]="'Goedkeuren ' + item.registrationId"
|
||||
[disabled]="deciding() === item.registrationId"
|
||||
(click)="decide(item.registrationId, 'goedkeuren')"
|
||||
>
|
||||
Goedkeuren
|
||||
</button>
|
||||
<button
|
||||
utrecht-button
|
||||
appearance="secondary-action-button"
|
||||
type="button"
|
||||
[attr.aria-label]="'Afwijzen ' + item.registrationId"
|
||||
[disabled]="deciding() === item.registrationId"
|
||||
(click)="decide(item.registrationId, 'afwijzen')"
|
||||
>
|
||||
Afwijzen
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
}
|
||||
</tbody>
|
||||
</table>
|
||||
}
|
||||
</utrecht-article>
|
||||
</main>
|
||||
@@ -1,110 +0,0 @@
|
||||
import { signal } from '@angular/core';
|
||||
import { fireEvent, render, screen } from '@testing-library/angular';
|
||||
import { of, throwError } from 'rxjs';
|
||||
import { BffApiV1Service, type WerkbakItem } from 'api-client';
|
||||
import { AuthService } from 'auth';
|
||||
import { axe } from 'vitest-axe';
|
||||
import { WerkbakPage } from './werkbak-page';
|
||||
|
||||
const sample: WerkbakItem[] = [
|
||||
{ registrationId: 'reg-1', bsn: '123456782', status: 'InBehandeling' },
|
||||
{ registrationId: 'reg-2', bsn: '111222333', status: 'InBehandeling' },
|
||||
];
|
||||
|
||||
class FakeAuth extends AuthService {
|
||||
readonly isAuthenticated = signal(true);
|
||||
readonly bsn = signal<string | undefined>(undefined);
|
||||
override readonly roles = signal<readonly string[]>(['behandelaar']);
|
||||
login(): void {
|
||||
/* not exercised here */
|
||||
}
|
||||
logout(): void {
|
||||
/* spied in tests */
|
||||
}
|
||||
}
|
||||
|
||||
function setup(
|
||||
overrides: {
|
||||
getBehandelWerkbak?: ReturnType<typeof vi.fn>;
|
||||
postBehandelRegistrationsIdDecide?: ReturnType<typeof vi.fn>;
|
||||
} = {},
|
||||
) {
|
||||
const getBehandelWerkbak =
|
||||
overrides.getBehandelWerkbak ?? vi.fn().mockReturnValue(of(sample));
|
||||
const postBehandelRegistrationsIdDecide =
|
||||
overrides.postBehandelRegistrationsIdDecide ?? vi.fn().mockReturnValue(of(undefined));
|
||||
return {
|
||||
getBehandelWerkbak,
|
||||
postBehandelRegistrationsIdDecide,
|
||||
providers: [
|
||||
{
|
||||
provide: BffApiV1Service,
|
||||
useValue: { getBehandelWerkbak, postBehandelRegistrationsIdDecide },
|
||||
},
|
||||
{ provide: AuthService, useClass: FakeAuth },
|
||||
],
|
||||
};
|
||||
}
|
||||
|
||||
describe('WerkbakPage', () => {
|
||||
it('lists the registrations awaiting beoordeling on open', async () => {
|
||||
const { getBehandelWerkbak, providers } = setup();
|
||||
await render(WerkbakPage, { providers });
|
||||
|
||||
expect(getBehandelWerkbak).toHaveBeenCalled();
|
||||
expect(await screen.findByText('reg-1')).toBeTruthy();
|
||||
expect(screen.getByText('123456782')).toBeTruthy();
|
||||
expect(screen.getByText('reg-2')).toBeTruthy();
|
||||
});
|
||||
|
||||
it('approves a registration (goedkeuren) and refreshes the werkbak', async () => {
|
||||
const { getBehandelWerkbak, postBehandelRegistrationsIdDecide, providers } = setup();
|
||||
await render(WerkbakPage, { providers });
|
||||
|
||||
fireEvent.click((await screen.findAllByRole('button', { name: /goedkeuren/i }))[0]);
|
||||
|
||||
expect(postBehandelRegistrationsIdDecide).toHaveBeenCalledWith('reg-1', {
|
||||
besluit: 'goedkeuren',
|
||||
});
|
||||
// Reloaded after the decision: once on open, once after deciding.
|
||||
expect(getBehandelWerkbak).toHaveBeenCalledTimes(2);
|
||||
});
|
||||
|
||||
it('rejects a registration (afwijzen) via the decide endpoint', async () => {
|
||||
const { postBehandelRegistrationsIdDecide, providers } = setup();
|
||||
await render(WerkbakPage, { providers });
|
||||
|
||||
fireEvent.click((await screen.findAllByRole('button', { name: /afwijzen/i }))[0]);
|
||||
|
||||
expect(postBehandelRegistrationsIdDecide).toHaveBeenCalledWith('reg-1', {
|
||||
besluit: 'afwijzen',
|
||||
});
|
||||
});
|
||||
|
||||
it('shows an empty state when the werkbak has no items', async () => {
|
||||
const { providers } = setup({ getBehandelWerkbak: vi.fn().mockReturnValue(of([])) });
|
||||
await render(WerkbakPage, { providers });
|
||||
|
||||
expect(await screen.findByText(/werkbak is leeg/i)).toBeTruthy();
|
||||
});
|
||||
|
||||
it('surfaces a load failure instead of swallowing it', async () => {
|
||||
const { providers } = setup({
|
||||
getBehandelWerkbak: vi.fn().mockReturnValue(throwError(() => new Error('403'))),
|
||||
});
|
||||
await render(WerkbakPage, { providers });
|
||||
|
||||
expect(await screen.findByText(/kon de werkbak niet laden/i)).toBeTruthy();
|
||||
});
|
||||
|
||||
it('has no WCAG 2.1 AA violations', async () => {
|
||||
document.documentElement.lang = 'nl';
|
||||
const { container } = await render(WerkbakPage, { providers: setup().providers });
|
||||
|
||||
const results = await axe(container, {
|
||||
runOnly: { type: 'tag', values: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'] },
|
||||
});
|
||||
|
||||
expect(results.violations).toEqual([]);
|
||||
});
|
||||
});
|
||||
@@ -1,65 +0,0 @@
|
||||
import { Component, inject, signal } from '@angular/core';
|
||||
import { BffApiV1Service, type WerkbakItem } from 'api-client';
|
||||
import { UtrechtComponentsModule } from 'ui';
|
||||
|
||||
/** The two decisions a behandelaar can make; the BFF validates these exact values (ADR-0013). */
|
||||
type Besluit = 'goedkeuren' | 'afwijzen';
|
||||
|
||||
/**
|
||||
* The behandel werkbak: a signed-in behandelaar sees the registrations awaiting beoordeling (the open
|
||||
* Flowable `Beoordelen` tasks, read through the domain) and decides each — goedkeuren or afwijzen. A
|
||||
* decision posts to the BFF, which applies the domain transition and completes the workflow task
|
||||
* (ADR-0013; S-12). After a decision the werkbak refreshes so the handled item drops off the list.
|
||||
*/
|
||||
@Component({
|
||||
selector: 'app-werkbak-page',
|
||||
imports: [UtrechtComponentsModule],
|
||||
templateUrl: './werkbak-page.html',
|
||||
})
|
||||
export class WerkbakPage {
|
||||
private readonly bff = inject(BffApiV1Service);
|
||||
|
||||
protected readonly items = signal<WerkbakItem[]>([]);
|
||||
protected readonly loading = signal(false);
|
||||
protected readonly loaded = signal(false);
|
||||
protected readonly failed = signal(false);
|
||||
protected readonly deciding = signal<string | undefined>(undefined);
|
||||
|
||||
constructor() {
|
||||
this.load();
|
||||
}
|
||||
|
||||
load(): void {
|
||||
this.loading.set(true);
|
||||
this.failed.set(false);
|
||||
this.bff.getBehandelWerkbak().subscribe({
|
||||
next: (rows: WerkbakItem[]) => {
|
||||
this.items.set(rows);
|
||||
this.loading.set(false);
|
||||
this.loaded.set(true);
|
||||
},
|
||||
// Surface the failure (e.g. 403 for a non-behandelaar) instead of swallowing it.
|
||||
error: () => {
|
||||
this.items.set([]);
|
||||
this.loading.set(false);
|
||||
this.loaded.set(true);
|
||||
this.failed.set(true);
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
decide(registrationId: string, besluit: Besluit): void {
|
||||
this.deciding.set(registrationId);
|
||||
this.bff.postBehandelRegistrationsIdDecide(registrationId, { besluit }).subscribe({
|
||||
// Refresh so the decided registration drops off the werkbak (its task is now completed).
|
||||
next: () => {
|
||||
this.deciding.set(undefined);
|
||||
this.load();
|
||||
},
|
||||
error: () => {
|
||||
this.deciding.set(undefined);
|
||||
this.failed.set(true);
|
||||
},
|
||||
});
|
||||
}
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
<!doctype html>
|
||||
<html lang="nl">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<title>Behandelportaal BIG-register</title>
|
||||
<base href="/" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
<link rel="icon" type="image/x-icon" href="favicon.ico" />
|
||||
</head>
|
||||
<body>
|
||||
<app-root></app-root>
|
||||
</body>
|
||||
</html>
|
||||
@@ -1,10 +0,0 @@
|
||||
import { bootstrapApplication } from '@angular/platform-browser';
|
||||
import { App } from './app/app';
|
||||
import { appConfig, type RuntimeConfig } from './app/app.config';
|
||||
|
||||
// Load environment config before bootstrap so the OIDC authority is set per environment
|
||||
// (dev: localhost; compose: keycloak:8080) from a single build — 12-factor (S-08d).
|
||||
fetch('config.json')
|
||||
.then((response) => response.json() as Promise<RuntimeConfig>)
|
||||
.then((config) => bootstrapApplication(App, appConfig(config)))
|
||||
.catch((err) => console.error(err));
|
||||
@@ -1,2 +0,0 @@
|
||||
/* NL Design System theme — Utrecht design tokens (docs/frontend-decisions.md). */
|
||||
@import '@utrecht/design-tokens/dist/index.css';
|
||||
@@ -1,9 +0,0 @@
|
||||
{
|
||||
"extends": "./tsconfig.json",
|
||||
"compilerOptions": {
|
||||
"outDir": "../../dist/out-tsc",
|
||||
"types": []
|
||||
},
|
||||
"include": ["src/**/*.ts"],
|
||||
"exclude": ["src/**/*.spec.ts", "src/**/*.test.ts"]
|
||||
}
|
||||
@@ -1,31 +0,0 @@
|
||||
{
|
||||
"extends": "../../tsconfig.base.json",
|
||||
"compilerOptions": {
|
||||
"strict": true,
|
||||
"noImplicitOverride": true,
|
||||
"noPropertyAccessFromIndexSignature": true,
|
||||
"noImplicitReturns": true,
|
||||
"noFallthroughCasesInSwitch": true,
|
||||
"isolatedModules": true,
|
||||
"target": "es2022",
|
||||
"moduleResolution": "bundler",
|
||||
"emitDecoratorMetadata": false,
|
||||
"module": "preserve"
|
||||
},
|
||||
"angularCompilerOptions": {
|
||||
"enableI18nLegacyMessageIdFormat": false,
|
||||
"strictInjectionParameters": true,
|
||||
"strictInputAccessModifiers": true,
|
||||
"strictTemplates": true
|
||||
},
|
||||
"files": [],
|
||||
"include": [],
|
||||
"references": [
|
||||
{
|
||||
"path": "./tsconfig.app.json"
|
||||
},
|
||||
{
|
||||
"path": "./tsconfig.spec.json"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
{
|
||||
"extends": "./tsconfig.json",
|
||||
"compilerOptions": {
|
||||
"outDir": "../../dist/out-tsc",
|
||||
"types": ["vitest/globals"]
|
||||
},
|
||||
"include": ["src/**/*.ts", "src/**/*.d.ts"]
|
||||
}
|
||||
@@ -248,30 +248,3 @@ curl -fsS "http://localhost:8140/openbaar/register?q=$ref" | jq
|
||||
|
||||
> The openbaar register's "Referentie" column and its search now use this reference — the exact value
|
||||
> the citizen saw on submit. Asserted end-to-end by the Playwright happy path.
|
||||
|
||||
## S-12 — Behandel portal: werkbak + beoordeling (#13, ADR-0013)
|
||||
|
||||
A behandelaar now works submitted registrations in a real portal instead of the temporary admin
|
||||
endpoint. After a citizen submits (as above), the workflow parks the registration at the Flowable
|
||||
`Beoordelen` user task, and it shows up in the **werkbak**. The behandelaar logs in against the
|
||||
Keycloak `medewerker` realm and decides — **goedkeuren** (→ INGESCHREVEN via the ACL, per ADR-0011)
|
||||
or **afwijzen** — which also completes the Beoordelen task so the process advances.
|
||||
|
||||
```text
|
||||
# 1. Open the behandel portal and log in as a behandelaar (medewerker realm):
|
||||
# http://localhost:8142/ → merel-behandelaar / test123
|
||||
#
|
||||
# 2. The werkbak lists the registrations awaiting beoordeling (referentie / bsn / status).
|
||||
# Find the reference from the submit confirmation and click "Goedkeuren" on that row.
|
||||
#
|
||||
# 3. The row drops off the werkbak (its Beoordelen task is completed) and the openbaar register
|
||||
# (http://localhost:8141/) now shows that reference as INGESCHREVEN.
|
||||
```
|
||||
|
||||
**The path:** behandel portal → BFF `POST /behandel/registrations/{id}/decide` (behandelaar policy,
|
||||
`medewerker` realm) → domain applies the decision + completes the Flowable `Beoordelen` task →
|
||||
ACL → NRC → event-subscriber → projection → openbaar register shows INGESCHREVEN.
|
||||
|
||||
> The full round-trip — DigiD submit → public INGEDIEND → behandelaar goedkeurt in the werkbak →
|
||||
> public INGESCHREVEN — is the Playwright happy path (`tests/e2e/registration.spec.ts`), which now
|
||||
> drives the behandel portal in place of the old admin endpoint.
|
||||
|
||||
@@ -117,37 +117,3 @@ with the submit form (S-08c, #67); any deviation from NL DS will be recorded her
|
||||
(id + status); `bsn`/`naam` never leave the BFF. The e2e asserts the bsn never renders.
|
||||
- **Loads on open, filters on search.** `RegisterPage` fetches the full register on construction and
|
||||
re-queries `/openbaar/register?q=` on search — no client-side filtering, the BFF owns the query.
|
||||
|
||||
## Behandel portal (S-12, #13)
|
||||
|
||||
The staff portal where a behandelaar works the **werkbak** (registrations awaiting beoordeling) and
|
||||
decides each — goedkeuren or afwijzen. `apps/behandel` mirrors `apps/self-service`; the net-new
|
||||
frontend work is the medewerker realm auth and the werkbak/decide page. Wiring rationale is in
|
||||
**ADR-0013**; this entry records the frontend-specific choices.
|
||||
|
||||
- **Medewerker realm auth, reusing `libs/auth`.** Staff authenticate against the Keycloak
|
||||
`medewerker` realm (public client `big-portal`), not `digid`. Rather than fork the auth lib, the
|
||||
abstract `AuthService` grew a **`roles`/`hasRole` surface** (empty for realms without roles, e.g.
|
||||
`digid`), and a parallel **`MedewerkerAuthService` + `provideMedewerkerAuth`** were added — same
|
||||
auth-code + PKCE config, bound to the medewerker realm, reading the nested `realm_access.roles`
|
||||
claim. The library's own `authInterceptor` attaches the token to the relative `/behandel/` calls
|
||||
(secure route), exactly as self-service does for `/self-service/`.
|
||||
- **Roles reach the frontend via a realm mapper.** Keycloak emits realm roles in the access token by
|
||||
default but not the ID token/userinfo the SPA reads, so the medewerker `big-portal` client gets a
|
||||
**realm-roles protocol mapper** (`realm_access.roles`, added to id + userinfo tokens). The
|
||||
**BFF remains the security boundary** (`behandelaar` policy, 401/403 on `/behandel/*`, ADR-0013);
|
||||
the frontend role signal is for display/UX, and the werkbak page surfaces a load failure (e.g. a
|
||||
403 for a non-behandelaar) rather than swallowing it.
|
||||
- **Same-origin via nginx, like the other portals.** The compose `behandel` image serves the built
|
||||
app and reverse-proxies `/behandel` to the BFF (relative calls, no CORS). Served on `:8142`,
|
||||
health-checked over IPv4 (`127.0.0.1`), depends on Keycloak for the medewerker realm.
|
||||
- **Werkbak = decide-and-refresh.** `WerkbakPage` loads `GET /behandel/werkbak` on open and renders a
|
||||
row per registration (referentie/bsn/status). Goedkeuren/afwijzen `POST /behandel/registrations/
|
||||
{id}/decide` and then reload the werkbak, so the handled item drops off (its Flowable `Beoordelen`
|
||||
task is completed). Per-row decide buttons carry an `aria-label` including the reference, so the
|
||||
e2e (and screen readers) can target a specific registration in a shared werkbak.
|
||||
- **Testing.** Component tests use `@testing-library/angular` with `BffApiV1Service`/`AuthService`
|
||||
mocked and the axe WCAG 2.1 AA check; an `app.config.spec` drives the real interceptor + api-client
|
||||
to assert the medewerker token attaches to `/behandel/*` (and not to the anonymous openbaar call).
|
||||
The full DigiD-submit → behandel-decide → public INGESCHREVEN round-trip is the Playwright happy
|
||||
path.
|
||||
|
||||
@@ -486,29 +486,6 @@ services:
|
||||
condition: service_healthy
|
||||
networks: [cg]
|
||||
|
||||
# The behandel portal: nginx serves the Angular app and reverse-proxies /behandel to the BFF.
|
||||
# Behandelaars log in against the Keycloak medewerker realm (ADR-0013; S-12).
|
||||
behandel:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: apps/behandel/Dockerfile
|
||||
image: register-referentie/behandel:dev
|
||||
ports:
|
||||
- "8142:80"
|
||||
healthcheck:
|
||||
# 127.0.0.1, not localhost: nginx listens on IPv4 only, but localhost resolves to ::1 first.
|
||||
test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 5
|
||||
start_period: 10s
|
||||
depends_on:
|
||||
bff:
|
||||
condition: service_healthy
|
||||
keycloak:
|
||||
condition: service_started
|
||||
networks: [cg]
|
||||
|
||||
volumes:
|
||||
oz-db:
|
||||
nrc-db:
|
||||
|
||||
@@ -16,22 +16,7 @@
|
||||
"standardFlowEnabled": true,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"redirectUris": ["*"],
|
||||
"webOrigins": ["*"],
|
||||
"protocolMappers": [
|
||||
{
|
||||
"name": "realm roles",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-realm-role-mapper",
|
||||
"config": {
|
||||
"multivalued": "true",
|
||||
"claim.name": "realm_access.roles",
|
||||
"jsonType.label": "String",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"userinfo.token.claim": "true"
|
||||
}
|
||||
}
|
||||
]
|
||||
"webOrigins": ["*"]
|
||||
}
|
||||
],
|
||||
"users": [
|
||||
|
||||
@@ -24,10 +24,6 @@ import {
|
||||
Observable
|
||||
} from 'rxjs';
|
||||
|
||||
export interface DecideRequest {
|
||||
besluit: string;
|
||||
}
|
||||
|
||||
export interface OpenbaarEntry {
|
||||
id: string;
|
||||
status: string;
|
||||
@@ -256,42 +252,4 @@ export class BffApiV1Service {
|
||||
);
|
||||
}
|
||||
|
||||
postBehandelRegistrationsIdDecide<TData = void>(id: string,
|
||||
decideRequest: DecideRequest, options?: HttpClientBodyOptions): Observable<TData>;
|
||||
postBehandelRegistrationsIdDecide<TData = void>(id: string,
|
||||
decideRequest: DecideRequest, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
|
||||
postBehandelRegistrationsIdDecide<TData = void>(id: string,
|
||||
decideRequest: DecideRequest, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
|
||||
postBehandelRegistrationsIdDecide<TData = void>(
|
||||
id: string,
|
||||
decideRequest: DecideRequest, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
|
||||
if (options?.observe === 'events') {
|
||||
return this.http.post<TData>(
|
||||
`/behandel/registrations/${id}/decide`,
|
||||
decideRequest,{
|
||||
...(options as Omit<NonNullable<typeof options>, 'observe'>),
|
||||
observe: 'events',
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
if (options?.observe === 'response') {
|
||||
return this.http.post<TData>(
|
||||
`/behandel/registrations/${id}/decide`,
|
||||
decideRequest,{
|
||||
...(options as Omit<NonNullable<typeof options>, 'observe'>),
|
||||
observe: 'response',
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
return this.http.post<TData>(
|
||||
`/behandel/registrations/${id}/decide`,
|
||||
decideRequest,{
|
||||
...(options as Omit<NonNullable<typeof options>, 'observe'>),
|
||||
observe: 'body',
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
};
|
||||
|
||||
@@ -1,6 +1,4 @@
|
||||
export * from './lib/auth.service';
|
||||
export * from './lib/digid-auth.service';
|
||||
export * from './lib/digid-auth.providers';
|
||||
export * from './lib/medewerker-auth.service';
|
||||
export * from './lib/medewerker-auth.providers';
|
||||
export * from './lib/authenticated.guard';
|
||||
|
||||
@@ -1,26 +1,16 @@
|
||||
import { signal, Signal } from '@angular/core';
|
||||
import { Signal } from '@angular/core';
|
||||
|
||||
/**
|
||||
* The portal's view of the signed-in user. An abstraction over the OIDC library so components and
|
||||
* guards depend on a small, mockable surface (the real implementations are DigiadAuthService for
|
||||
* citizens and MedewerkerAuthService for staff).
|
||||
* guards depend on a small, mockable surface (the real implementation is DigiadAuthService).
|
||||
*/
|
||||
export abstract class AuthService {
|
||||
/** Whether a session is active. */
|
||||
/** Whether a DigiD session is active. */
|
||||
abstract readonly isAuthenticated: Signal<boolean>;
|
||||
/** The citizen-service number from the DigiD token, once authenticated (staff have none). */
|
||||
/** The citizen-service number from the DigiD token, once authenticated. */
|
||||
abstract readonly bsn: Signal<string | undefined>;
|
||||
/**
|
||||
* The realm roles carried in the token. Empty for realms that don't grant roles (e.g. `digid`);
|
||||
* the `medewerker` realm carries `behandelaar`/`teamlead`.
|
||||
*/
|
||||
readonly roles: Signal<readonly string[]> = signal<readonly string[]>([]);
|
||||
/** Start login (redirects to Keycloak). */
|
||||
/** Start the DigiD login (redirects to Keycloak). */
|
||||
abstract login(): void;
|
||||
/** End the session. */
|
||||
abstract logout(): void;
|
||||
/** Whether the signed-in user holds the given realm role. */
|
||||
hasRole(role: string): boolean {
|
||||
return this.roles().includes(role);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
import { EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';
|
||||
import { LogLevel, provideAuth, withAppInitializerAuthCheck } from 'angular-auth-oidc-client';
|
||||
import { AuthService } from './auth.service';
|
||||
import { MedewerkerAuthService } from './medewerker-auth.service';
|
||||
|
||||
export interface MedewerkerAuthOptions {
|
||||
/** The Keycloak `medewerker` realm issuer, as reachable from the browser. */
|
||||
authority: string;
|
||||
/** Where Keycloak redirects back to after login (usually the app origin). */
|
||||
redirectUrl: string;
|
||||
/**
|
||||
* Route prefixes whose requests get the bearer token attached. The api-client calls the BFF with
|
||||
* **relative** URLs (same-origin via the nginx proxy), so these must be relative path prefixes
|
||||
* (e.g. `/behandel/`) — angular-auth-oidc-client matches `req.url.startsWith(route)`, and a
|
||||
* relative `req.url` never starts with an absolute origin.
|
||||
*/
|
||||
secureRoutes: string[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Configure medewerker login (Keycloak `medewerker` realm, public client `big-portal`, auth-code +
|
||||
* PKCE) and bind {@link AuthService} to the medewerker-backed implementation. Register
|
||||
* {@link authInterceptor} (re-exported from digid-auth.providers) in the app's HttpClient so BFF
|
||||
* calls carry the token.
|
||||
*/
|
||||
export function provideMedewerkerAuth(options: MedewerkerAuthOptions): EnvironmentProviders {
|
||||
return makeEnvironmentProviders([
|
||||
provideAuth(
|
||||
{
|
||||
config: {
|
||||
authority: options.authority,
|
||||
redirectUrl: options.redirectUrl,
|
||||
postLogoutRedirectUri: options.redirectUrl,
|
||||
clientId: 'big-portal',
|
||||
scope: 'openid profile',
|
||||
responseType: 'code',
|
||||
silentRenew: true,
|
||||
useRefreshToken: true,
|
||||
secureRoutes: options.secureRoutes,
|
||||
logLevel: LogLevel.Warn,
|
||||
},
|
||||
},
|
||||
// Run checkAuth() at startup so the login callback (?code=…) is processed before the router
|
||||
// and guard run — without it the guard sees "not authenticated" and re-triggers login (loop).
|
||||
withAppInitializerAuthCheck(),
|
||||
),
|
||||
{ provide: AuthService, useClass: MedewerkerAuthService },
|
||||
]);
|
||||
}
|
||||
@@ -1,43 +0,0 @@
|
||||
import { TestBed } from '@angular/core/testing';
|
||||
import { OidcSecurityService } from 'angular-auth-oidc-client';
|
||||
import { of } from 'rxjs';
|
||||
import { MedewerkerAuthService } from './medewerker-auth.service';
|
||||
|
||||
function makeService(userData: unknown, authenticated = true) {
|
||||
const oidc = {
|
||||
isAuthenticated$: of({ isAuthenticated: authenticated }),
|
||||
userData$: of({ userData }),
|
||||
authorize: vi.fn(),
|
||||
logoff: vi.fn(() => of(null)),
|
||||
};
|
||||
TestBed.configureTestingModule({
|
||||
providers: [MedewerkerAuthService, { provide: OidcSecurityService, useValue: oidc }],
|
||||
});
|
||||
return { svc: TestBed.inject(MedewerkerAuthService), oidc };
|
||||
}
|
||||
|
||||
describe('MedewerkerAuthService', () => {
|
||||
it('exposes the realm roles carried in the token', () => {
|
||||
const { svc } = makeService({ realm_access: { roles: ['behandelaar', 'teamlead'] } });
|
||||
expect(svc.roles()).toEqual(['behandelaar', 'teamlead']);
|
||||
expect(svc.hasRole('behandelaar')).toBe(true);
|
||||
expect(svc.hasRole('beheerder')).toBe(false);
|
||||
});
|
||||
|
||||
it('has no roles when the token omits realm_access', () => {
|
||||
const { svc } = makeService({ preferred_username: 'merel-behandelaar' });
|
||||
expect(svc.roles()).toEqual([]);
|
||||
expect(svc.hasRole('behandelaar')).toBe(false);
|
||||
});
|
||||
|
||||
it('reflects the OIDC authenticated state', () => {
|
||||
const { svc } = makeService({}, true);
|
||||
expect(svc.isAuthenticated()).toBe(true);
|
||||
});
|
||||
|
||||
it('starts login by delegating to the OIDC library', () => {
|
||||
const { svc, oidc } = makeService({});
|
||||
svc.login();
|
||||
expect(oidc.authorize).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
});
|
||||
@@ -1,41 +0,0 @@
|
||||
import { inject, Injectable, Signal } from '@angular/core';
|
||||
import { toSignal } from '@angular/core/rxjs-interop';
|
||||
import { OidcSecurityService } from 'angular-auth-oidc-client';
|
||||
import { map } from 'rxjs';
|
||||
import { AuthService } from './auth.service';
|
||||
|
||||
/** The subset of the medewerker token the portal reads: Keycloak nests realm roles here. */
|
||||
interface MedewerkerClaims {
|
||||
realm_access?: { roles?: string[] };
|
||||
}
|
||||
|
||||
/** Medewerker-backed AuthService over angular-auth-oidc-client (Keycloak `medewerker` realm). */
|
||||
@Injectable()
|
||||
export class MedewerkerAuthService extends AuthService {
|
||||
private readonly oidc = inject(OidcSecurityService);
|
||||
|
||||
readonly isAuthenticated: Signal<boolean> = toSignal(
|
||||
this.oidc.isAuthenticated$.pipe(map((result) => result.isAuthenticated)),
|
||||
{ initialValue: false },
|
||||
);
|
||||
|
||||
// Staff have no BSN; the abstract surface keeps this present for the shared guard/interceptor.
|
||||
readonly bsn: Signal<string | undefined> = toSignal(this.oidc.userData$.pipe(map(() => undefined)), {
|
||||
initialValue: undefined,
|
||||
});
|
||||
|
||||
override readonly roles: Signal<readonly string[]> = toSignal(
|
||||
this.oidc.userData$.pipe(
|
||||
map((data) => (data.userData as MedewerkerClaims | null)?.realm_access?.roles ?? []),
|
||||
),
|
||||
{ initialValue: [] },
|
||||
);
|
||||
|
||||
override login(): void {
|
||||
this.oidc.authorize();
|
||||
}
|
||||
|
||||
override logout(): void {
|
||||
this.oidc.logoff().subscribe();
|
||||
}
|
||||
}
|
||||
@@ -24,9 +24,6 @@ public interface IDomainClient
|
||||
|
||||
/// <summary>The behandelaar's werkbak — registrations awaiting beoordeling.</summary>
|
||||
Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default);
|
||||
|
||||
/// <summary>Apply a behandelaar's decision (<c>goedkeuren</c>/<c>afwijzen</c>) to a registration.</summary>
|
||||
Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default);
|
||||
}
|
||||
|
||||
/// <summary>Port to the read projection.</summary>
|
||||
@@ -50,13 +47,6 @@ public sealed class DomainClient(HttpClient http) : IDomainClient
|
||||
public async Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
|
||||
=> await http.GetFromJsonAsync<List<WerkbakItem>>("behandel/werkbak", ct) ?? [];
|
||||
|
||||
public async Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
|
||||
{
|
||||
using var response = await http.PostAsJsonAsync(
|
||||
$"registrations/{registrationId}/decide", new { besluit }, ct);
|
||||
response.EnsureSuccessStatusCode();
|
||||
}
|
||||
|
||||
private sealed record DomainResponse(string RegistrationId, string Status, string? ZaakUrl);
|
||||
}
|
||||
|
||||
|
||||
@@ -103,28 +103,8 @@ app.MapGet("/behandel/werkbak", async (IDomainClient domain, CancellationToken c
|
||||
.Produces(StatusCodes.Status401Unauthorized)
|
||||
.Produces(StatusCodes.Status403Forbidden);
|
||||
|
||||
// A behandelaar's beoordeling on a registration (goedkeuren/afwijzen). Forwarded to the domain, which
|
||||
// applies the decision and completes the workflow task (ADR-0013). Same medewerker/behandelaar gate.
|
||||
app.MapPost("/behandel/registrations/{id}/decide",
|
||||
async (string id, DecideRequest body, IDomainClient domain, CancellationToken ct) =>
|
||||
{
|
||||
if (!BehandelAuth.IsKnownBesluit(body.Besluit))
|
||||
return Results.BadRequest(new { error = $"Unknown besluit '{body.Besluit}'. Expected 'goedkeuren' or 'afwijzen'." });
|
||||
|
||||
await domain.DecideAsync(id, body.Besluit, ct);
|
||||
return Results.NoContent();
|
||||
})
|
||||
.RequireAuthorization(BehandelAuth.Policy)
|
||||
.Produces(StatusCodes.Status204NoContent)
|
||||
.Produces(StatusCodes.Status400BadRequest)
|
||||
.Produces(StatusCodes.Status401Unauthorized)
|
||||
.Produces(StatusCodes.Status403Forbidden);
|
||||
|
||||
app.Run();
|
||||
|
||||
/// <summary>The behandelaar's decision on a registration.</summary>
|
||||
public sealed record DecideRequest(string Besluit);
|
||||
|
||||
// Behandel (medewerker-realm) authentication + authorization wiring (ADR-0013).
|
||||
internal static class BehandelAuth
|
||||
{
|
||||
@@ -132,12 +112,6 @@ internal static class BehandelAuth
|
||||
public const string Policy = "behandelaar";
|
||||
public const string BehandelaarRole = "behandelaar";
|
||||
|
||||
/// <summary>The beoordeling vocabulary the BFF accepts (case-insensitive); an unknown besluit is a
|
||||
/// 400 without troubling the domain. Mirrors the domain's <c>BeoordelingsBesluit</c>.</summary>
|
||||
public static bool IsKnownBesluit(string? besluit) =>
|
||||
string.Equals(besluit, "goedkeuren", StringComparison.OrdinalIgnoreCase) ||
|
||||
string.Equals(besluit, "afwijzen", StringComparison.OrdinalIgnoreCase);
|
||||
|
||||
/// <summary>Lift Keycloak's realm roles (the nested <c>realm_access.roles</c> claim) onto the
|
||||
/// principal as role claims, so <c>RequireRole</c> can authorize on them.</summary>
|
||||
public static void AddRealmRoles(ClaimsPrincipal? principal)
|
||||
|
||||
@@ -54,61 +54,4 @@ public class BehandelEndpointTests
|
||||
Assert.Equal("reg-1", item.RegistrationId);
|
||||
Assert.Equal("123456782", item.Bsn);
|
||||
}
|
||||
|
||||
private static HttpRequestMessage Decide(string? bearer, string id = "reg-1", string besluit = "goedkeuren")
|
||||
{
|
||||
var request = new HttpRequestMessage(HttpMethod.Post, $"/behandel/registrations/{id}/decide")
|
||||
{
|
||||
Content = JsonContent.Create(new { besluit }),
|
||||
};
|
||||
if (bearer is not null)
|
||||
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
|
||||
return request;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Rejects_a_decision_without_a_token()
|
||||
{
|
||||
using var factory = new BffFactory();
|
||||
|
||||
var response = await factory.CreateClient().SendAsync(Decide(bearer: null));
|
||||
|
||||
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
|
||||
Assert.Null(factory.Domain.Decided);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Rejects_a_decision_from_a_medewerker_without_the_behandelaar_role()
|
||||
{
|
||||
using var factory = new BffFactory();
|
||||
|
||||
var response = await factory.CreateClient().SendAsync(Decide(TestTokens.Medewerker("teamlead")));
|
||||
|
||||
Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
|
||||
Assert.Null(factory.Domain.Decided);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Forwards_a_behandelaar_decision_to_the_domain()
|
||||
{
|
||||
using var factory = new BffFactory();
|
||||
|
||||
var response = await factory.CreateClient()
|
||||
.SendAsync(Decide(TestTokens.Medewerker("behandelaar"), id: "reg-42", besluit: "afwijzen"));
|
||||
|
||||
Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
|
||||
Assert.Equal(("reg-42", "afwijzen"), factory.Domain.Decided);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Rejects_an_unknown_besluit_without_calling_the_domain()
|
||||
{
|
||||
using var factory = new BffFactory();
|
||||
|
||||
var response = await factory.CreateClient()
|
||||
.SendAsync(Decide(TestTokens.Medewerker("behandelaar"), besluit: "misschien"));
|
||||
|
||||
Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
|
||||
Assert.Null(factory.Domain.Decided);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -82,16 +82,8 @@ internal sealed class FakeDomainClient : IDomainClient
|
||||
return Task.FromResult(Result);
|
||||
}
|
||||
|
||||
public (string RegistrationId, string Besluit)? Decided { get; private set; }
|
||||
|
||||
public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
|
||||
=> Task.FromResult<IReadOnlyList<WerkbakItem>>(Werkbak);
|
||||
|
||||
public Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
|
||||
{
|
||||
Decided = (registrationId, besluit);
|
||||
return Task.CompletedTask;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Serves a configurable set of projection rows.</summary>
|
||||
|
||||
@@ -88,62 +88,10 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/behandel/registrations/{id}/decide": {
|
||||
"post": {
|
||||
"tags": [
|
||||
"Bff.Api"
|
||||
],
|
||||
"parameters": [
|
||||
{
|
||||
"name": "id",
|
||||
"in": "path",
|
||||
"required": true,
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"requestBody": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/DecideRequest"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": true
|
||||
},
|
||||
"responses": {
|
||||
"204": {
|
||||
"description": "No Content"
|
||||
},
|
||||
"400": {
|
||||
"description": "Bad Request"
|
||||
},
|
||||
"401": {
|
||||
"description": "Unauthorized"
|
||||
},
|
||||
"403": {
|
||||
"description": "Forbidden"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"components": {
|
||||
"schemas": {
|
||||
"DecideRequest": {
|
||||
"required": [
|
||||
"besluit"
|
||||
],
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"besluit": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"OpenbaarEntry": {
|
||||
"required": [
|
||||
"id",
|
||||
|
||||
@@ -20,12 +20,10 @@ public sealed record BeoordeelRegistratieCommand(RegistrationId RegistrationId,
|
||||
/// <see cref="BeoordelingsBesluit.Goedkeuren"/> sets the zaak's final status via the ACL (§8.1) and
|
||||
/// advances the aggregate to INGESCHREVEN; <see cref="BeoordelingsBesluit.Afwijzen"/> advances it to
|
||||
/// AFGEWEZEN in the domain (propagating a rejection to the zaak, so the openbaar projection reflects
|
||||
/// it, is a later sub-slice of S-12). After applying the decision it completes the Flowable
|
||||
/// <c>Beoordelen</c> task (found by registrationId) so the workflow advances (ADR-0013). Both
|
||||
/// decisions are idempotent — a repeated or redelivered decision that matches the current terminal
|
||||
/// state is a no-op, so the ACL is not called and the task not completed twice.
|
||||
/// it, is a later sub-slice of S-12). Both decisions are idempotent — a repeated or redelivered
|
||||
/// decision that matches the current terminal state is a no-op, so the ACL is not called twice.
|
||||
/// </summary>
|
||||
public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl, IUserTaskClient tasks)
|
||||
public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl)
|
||||
{
|
||||
public async Task HandleAsync(BeoordeelRegistratieCommand command, CancellationToken ct = default)
|
||||
{
|
||||
@@ -55,17 +53,5 @@ public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient ac
|
||||
}
|
||||
|
||||
await store.SaveAsync(registration, ct);
|
||||
await CompleteWorkflowTaskAsync(command.RegistrationId, command.Besluit, ct);
|
||||
}
|
||||
|
||||
// Advance the workflow: complete the open Beoordelen task for this registration. If none is open
|
||||
// (already completed, or the process hasn't parked yet) the decision still stands — we complete
|
||||
// nothing rather than fail.
|
||||
private async Task CompleteWorkflowTaskAsync(RegistrationId registrationId, BeoordelingsBesluit besluit, CancellationToken ct)
|
||||
{
|
||||
var open = await tasks.GetOpenBeoordelingenAsync(ct);
|
||||
var task = open.FirstOrDefault(t => t.RegistrationId == registrationId);
|
||||
if (task is not null)
|
||||
await tasks.CompleteBeoordelingAsync(task.TaskId, besluit, ct);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -6,8 +6,8 @@ namespace Big.Tests;
|
||||
/// <summary>
|
||||
/// The beoordeling use case (S-12): a behandelaar's decision on a registration. Goedkeuren sets the
|
||||
/// zaak's final status via the ACL (§8.1) and marks the aggregate INGESCHREVEN; Afwijzen marks it
|
||||
/// AFGEWEZEN. Either way the decision also completes the Flowable Beoordelen task (found by
|
||||
/// registrationId) so the process advances. All idempotent — a repeated decision is a no-op.
|
||||
/// AFGEWEZEN in the domain (propagating a rejection to the zaak is a later sub-slice). Both are
|
||||
/// idempotent so a repeated or redelivered decision is a no-op.
|
||||
/// </summary>
|
||||
public class BeoordeelRegistratieTests
|
||||
{
|
||||
@@ -18,9 +18,6 @@ public class BeoordeelRegistratieTests
|
||||
return registration;
|
||||
}
|
||||
|
||||
private static FakeUserTaskClient TaskFor(Registration registration) =>
|
||||
new([new BeoordelingTask("task-1", registration.Id)]);
|
||||
|
||||
[Fact]
|
||||
public async Task Goedkeuren_sets_the_zaak_status_via_the_acl_and_marks_the_registration_ingeschreven()
|
||||
{
|
||||
@@ -28,8 +25,7 @@ public class BeoordeelRegistratieTests
|
||||
var acl = new FakeAclClient();
|
||||
var registration = WithZaak();
|
||||
store.Seed(registration);
|
||||
var tasks = TaskFor(registration);
|
||||
var handler = new BeoordeelRegistratie(store, acl, tasks);
|
||||
var handler = new BeoordeelRegistratie(store, acl);
|
||||
|
||||
await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
|
||||
|
||||
@@ -38,8 +34,6 @@ public class BeoordeelRegistratieTests
|
||||
Assert.Equal(FakeAclClient.DefaultZaakUrl, acl.ApprovedZaakUrl);
|
||||
Assert.Equal(1, acl.ApproveCallCount);
|
||||
Assert.Equal(1, store.SaveCount);
|
||||
// The behandelaar's decision advances the workflow: the Beoordelen task is completed.
|
||||
Assert.Equal(("task-1", BeoordelingsBesluit.Goedkeuren), tasks.Completed);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
@@ -49,8 +43,7 @@ public class BeoordeelRegistratieTests
|
||||
var acl = new FakeAclClient();
|
||||
var registration = WithZaak();
|
||||
store.Seed(registration);
|
||||
var tasks = TaskFor(registration);
|
||||
var handler = new BeoordeelRegistratie(store, acl, tasks);
|
||||
var handler = new BeoordeelRegistratie(store, acl);
|
||||
|
||||
await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Afwijzen));
|
||||
|
||||
@@ -58,7 +51,6 @@ public class BeoordeelRegistratieTests
|
||||
Assert.Equal(RegistrationStatus.Afgewezen, saved!.Status);
|
||||
Assert.Equal(0, acl.ApproveCallCount);
|
||||
Assert.Equal(1, store.SaveCount);
|
||||
Assert.Equal(("task-1", BeoordelingsBesluit.Afwijzen), tasks.Completed);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
@@ -69,7 +61,7 @@ public class BeoordeelRegistratieTests
|
||||
var registration = WithZaak();
|
||||
registration.TakeIntoBehandeling();
|
||||
store.Seed(registration);
|
||||
var handler = new BeoordeelRegistratie(store, acl, TaskFor(registration));
|
||||
var handler = new BeoordeelRegistratie(store, acl);
|
||||
|
||||
await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
|
||||
|
||||
@@ -81,7 +73,7 @@ public class BeoordeelRegistratieTests
|
||||
{
|
||||
var store = new FakeRegistrationStore();
|
||||
var acl = new FakeAclClient();
|
||||
var handler = new BeoordeelRegistratie(store, acl, new FakeUserTaskClient([]));
|
||||
var handler = new BeoordeelRegistratie(store, acl);
|
||||
|
||||
await Assert.ThrowsAsync<ArgumentNullException>(() => handler.HandleAsync(null!));
|
||||
Assert.Equal(0, acl.ApproveCallCount);
|
||||
@@ -93,7 +85,7 @@ public class BeoordeelRegistratieTests
|
||||
{
|
||||
var store = new FakeRegistrationStore();
|
||||
var acl = new FakeAclClient();
|
||||
var handler = new BeoordeelRegistratie(store, acl, new FakeUserTaskClient([]));
|
||||
var handler = new BeoordeelRegistratie(store, acl);
|
||||
|
||||
var ex = await Assert.ThrowsAsync<InvalidOperationException>(() =>
|
||||
handler.HandleAsync(new BeoordeelRegistratieCommand(RegistrationId.New(), BeoordelingsBesluit.Goedkeuren)));
|
||||
@@ -108,7 +100,7 @@ public class BeoordeelRegistratieTests
|
||||
var acl = new FakeAclClient();
|
||||
var registration = Registration.Submit("123456782"); // no zaak yet
|
||||
store.Seed(registration);
|
||||
var handler = new BeoordeelRegistratie(store, acl, TaskFor(registration));
|
||||
var handler = new BeoordeelRegistratie(store, acl);
|
||||
|
||||
var ex = await Assert.ThrowsAsync<InvalidOperationException>(() =>
|
||||
handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren)));
|
||||
@@ -123,7 +115,7 @@ public class BeoordeelRegistratieTests
|
||||
var acl = new FakeAclClient();
|
||||
var registration = WithZaak();
|
||||
store.Seed(registration);
|
||||
var handler = new BeoordeelRegistratie(store, acl, TaskFor(registration));
|
||||
var handler = new BeoordeelRegistratie(store, acl);
|
||||
|
||||
await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
|
||||
await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
|
||||
@@ -139,7 +131,7 @@ public class BeoordeelRegistratieTests
|
||||
var acl = new FakeAclClient();
|
||||
var registration = WithZaak();
|
||||
store.Seed(registration);
|
||||
var handler = new BeoordeelRegistratie(store, acl, TaskFor(registration));
|
||||
var handler = new BeoordeelRegistratie(store, acl);
|
||||
|
||||
await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Afwijzen));
|
||||
await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Afwijzen));
|
||||
@@ -147,22 +139,4 @@ public class BeoordeelRegistratieTests
|
||||
Assert.Equal(1, store.SaveCount);
|
||||
Assert.Equal(RegistrationStatus.Afgewezen, (await store.GetAsync(registration.Id))!.Status);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Deciding_completes_no_task_when_none_is_open_for_the_registration()
|
||||
{
|
||||
// The task may already be gone (redelivery / manual completion). The decision still applies
|
||||
// and simply completes nothing rather than failing.
|
||||
var store = new FakeRegistrationStore();
|
||||
var acl = new FakeAclClient();
|
||||
var registration = WithZaak();
|
||||
store.Seed(registration);
|
||||
var tasks = new FakeUserTaskClient([]); // no open task for this registration
|
||||
var handler = new BeoordeelRegistratie(store, acl, tasks);
|
||||
|
||||
await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
|
||||
|
||||
Assert.Equal(RegistrationStatus.Ingeschreven, (await store.GetAsync(registration.Id))!.Status);
|
||||
Assert.Null(tasks.Completed);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -15,7 +15,6 @@ Feature: Een registratie beoordelen
|
||||
When the behandelaar decides "goedkeuren"
|
||||
Then the registration has status "INGESCHREVEN"
|
||||
And the zaak's final status is set via the ACL
|
||||
And the beoordeling task is completed with "goedkeuren"
|
||||
|
||||
Scenario: Afwijzen wijst de registratie af zonder de ACL
|
||||
Given a submitted registration with an opened zaak
|
||||
@@ -23,4 +22,3 @@ Feature: Een registratie beoordelen
|
||||
And the behandelaar decides "afwijzen"
|
||||
Then the registration has status "AFGEWEZEN"
|
||||
And the ACL is not asked to set the zaak status
|
||||
And the beoordeling task is completed with "afwijzen"
|
||||
|
||||
@@ -16,7 +16,6 @@ public sealed class EenRegistratieBeoordelenSteps
|
||||
{
|
||||
private readonly InMemoryAclClient _acl = new();
|
||||
private readonly InMemoryRegistrationStore _store = new();
|
||||
private readonly InMemoryUserTaskClient _tasks = new();
|
||||
private RegistrationId _id;
|
||||
|
||||
[Given("a submitted registration with an opened zaak")]
|
||||
@@ -26,8 +25,6 @@ public sealed class EenRegistratieBeoordelenSteps
|
||||
registration.AttachZaak(InMemoryAclClient.OpenedZaakUrl);
|
||||
await _store.SaveAsync(registration);
|
||||
_id = registration.Id;
|
||||
// The process has parked at the Beoordelen user task awaiting the behandelaar.
|
||||
_tasks.Open(_id);
|
||||
}
|
||||
|
||||
[When("the behandelaar takes it into behandeling")]
|
||||
@@ -40,7 +37,7 @@ public sealed class EenRegistratieBeoordelenSteps
|
||||
|
||||
[When("the behandelaar decides \"(.*)\"")]
|
||||
public async Task WhenTheBehandelaarDecides(string besluit)
|
||||
=> await new BeoordeelRegistratie(_store, _acl, _tasks).HandleAsync(
|
||||
=> await new BeoordeelRegistratie(_store, _acl).HandleAsync(
|
||||
new BeoordeelRegistratieCommand(_id, Enum.Parse<BeoordelingsBesluit>(besluit, ignoreCase: true)));
|
||||
|
||||
[Then("the registration has status \"(.*)\"")]
|
||||
@@ -58,8 +55,4 @@ public sealed class EenRegistratieBeoordelenSteps
|
||||
[Then("the ACL is not asked to set the zaak status")]
|
||||
public void ThenTheAclIsNotAskedToSetTheZaakStatus()
|
||||
=> Assert.Null(_acl.ApprovedZaakUrl);
|
||||
|
||||
[Then("the beoordeling task is completed with \"(.*)\"")]
|
||||
public void ThenTheBeoordelingTaskIsCompletedWith(string besluit)
|
||||
=> Assert.Equal(Enum.Parse<BeoordelingsBesluit>(besluit, ignoreCase: true), _tasks.Completed?.Besluit);
|
||||
}
|
||||
|
||||
@@ -71,9 +71,6 @@ public sealed class CapturingDomainClient : IDomainClient
|
||||
|
||||
public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
|
||||
=> Task.FromResult<IReadOnlyList<WerkbakItem>>([]);
|
||||
|
||||
public Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
|
||||
=> Task.CompletedTask;
|
||||
}
|
||||
|
||||
/// <summary>Serves configurable projection rows.</summary>
|
||||
|
||||
@@ -43,29 +43,6 @@ public sealed class InMemoryAclClient : IAclClient
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>An in-memory user-task client for the beoordeling acceptance scenario: it holds one open
|
||||
/// Beoordelen task per registration and records the besluit each is completed with.</summary>
|
||||
public sealed class InMemoryUserTaskClient : IUserTaskClient
|
||||
{
|
||||
private readonly List<BeoordelingTask> _open = [];
|
||||
|
||||
public (string TaskId, BeoordelingsBesluit Besluit)? Completed { get; private set; }
|
||||
|
||||
public void Open(RegistrationId registrationId) => _open.Add(new BeoordelingTask($"task-{registrationId}", registrationId));
|
||||
|
||||
public Task<IReadOnlyList<BeoordelingTask>> GetOpenBeoordelingenAsync(CancellationToken ct = default)
|
||||
=> Task.FromResult<IReadOnlyList<BeoordelingTask>>(_open);
|
||||
|
||||
public Task ClaimAsync(string taskId, string behandelaar, CancellationToken ct = default) => Task.CompletedTask;
|
||||
|
||||
public Task CompleteBeoordelingAsync(string taskId, BeoordelingsBesluit besluit, CancellationToken ct = default)
|
||||
{
|
||||
Completed = (taskId, besluit);
|
||||
_open.RemoveAll(t => t.TaskId == taskId);
|
||||
return Task.CompletedTask;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>An in-memory registration store for the domain acceptance scenario.</summary>
|
||||
public sealed class InMemoryRegistrationStore : IRegistrationStore
|
||||
{
|
||||
|
||||
@@ -3,9 +3,6 @@ import { defineConfig, devices } from '@playwright/test';
|
||||
// The e2e runs inside the compose network (infra/run-e2e-check.sh); baseURL defaults to the
|
||||
// self-service service. Keep timeouts generous — the first navigation triggers the DigiD flow.
|
||||
const baseURL = process.env.SELF_SERVICE_URL ?? 'http://self-service';
|
||||
// The behandel portal is a second origin the happy path visits (staff approve from the werkbak);
|
||||
// it needs the same insecure-origin-as-secure treatment as self-service for the PKCE login (below).
|
||||
const behandelURL = process.env.BEHANDEL_URL ?? 'http://behandel';
|
||||
|
||||
export default defineConfig({
|
||||
testDir: '.',
|
||||
@@ -25,9 +22,7 @@ export default defineConfig({
|
||||
// the production HTTPS context. This flag is only honoured by the full Chromium build (new
|
||||
// headless), not Playwright's default headless-shell, so pin `channel: 'chromium'`.
|
||||
channel: 'chromium',
|
||||
launchOptions: {
|
||||
args: [`--unsafely-treat-insecure-origin-as-secure=${baseURL},${behandelURL}`],
|
||||
},
|
||||
launchOptions: { args: [`--unsafely-treat-insecure-origin-as-secure=${baseURL}`] },
|
||||
},
|
||||
projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
|
||||
});
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
import { expect, test } from '@playwright/test';
|
||||
|
||||
// Walking-skeleton happy path (S-08d + S-09 + S-09b + S-12): a zorgprofessional logs in via mock
|
||||
// DigiD and submits through the self-service portal → BFF → domain; the entry appears in the openbaar
|
||||
// register as INGEDIEND; a behandelaar then logs in to the behandel portal, finds the registration in
|
||||
// the werkbak, and approves it (goedkeuren); the decision completes the Flowable Beoordelen task and
|
||||
// flows via the ACL → NRC → event-subscriber → projection, and the openbaar register shows INGESCHREVEN.
|
||||
test('DigiD submit → public INGEDIEND → behandelaar goedkeurt → public INGESCHREVEN', async ({ page }) => {
|
||||
// Walking-skeleton happy path (S-08d + S-09 + S-09b): a zorgprofessional logs in via mock DigiD and
|
||||
// submits through the self-service portal → BFF → domain; the entry appears in the openbaar register
|
||||
// as INGEDIEND; a behandelaar approves it via the temporary admin endpoint; the approval flows via the
|
||||
// ACL → NRC → event-subscriber → projection, and the openbaar register then shows it as INGESCHREVEN.
|
||||
test('DigiD login → submit → public INGEDIEND → approve → public INGESCHREVEN', async ({ page, request }) => {
|
||||
// Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
|
||||
await page.goto('/');
|
||||
|
||||
@@ -44,42 +43,21 @@ test('DigiD submit → public INGEDIEND → behandelaar goedkeurt → public ING
|
||||
await expect(page.getByRole('row', { name: reference }).getByRole('cell', { name: 'INGEDIEND' }))
|
||||
.toBeVisible();
|
||||
|
||||
// A behandelaar picks the registration up in the behandel-portal werkbak and approves it
|
||||
// (goedkeuren) — the S-12 flow that replaces the temporary admin endpoint. Navigating here switches
|
||||
// to the medewerker realm (a different Keycloak realm than the citizen's digid session).
|
||||
await page.goto('http://behandel/');
|
||||
await page.locator('#username').fill('merel-behandelaar');
|
||||
await page.locator('#password').fill('test123');
|
||||
await page.locator('#kc-login').click();
|
||||
|
||||
await expect(page.getByRole('heading', { name: /Werkbak/i })).toBeVisible();
|
||||
|
||||
// The registration parks at the Beoordelen user task only after the worker has opened its zaak, so
|
||||
// it appears in the werkbak asynchronously — reload until this reference's row shows up. Target the
|
||||
// decide button by reference (not a generic "Goedkeuren"): the shared verify stack holds other open
|
||||
// tasks, so a positional match could act on someone else's registration.
|
||||
const goedkeuren = page.getByRole('button', { name: `Goedkeuren ${reference}` });
|
||||
// Approve via the temporary admin endpoint (reached directly on the compose network, as a
|
||||
// behandelaar would until the behandel-portal exists — S-12). The zaak is opened off the request
|
||||
// path by the worker, so wait for it before approving.
|
||||
await expect
|
||||
.poll(async () => {
|
||||
await page.reload();
|
||||
return goedkeuren.count();
|
||||
const res = await request.get(`http://domain:8080/registrations/${reference}`);
|
||||
return res.ok() ? (await res.json()).zaakUrl : null;
|
||||
}, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
|
||||
.toBeGreaterThan(0);
|
||||
.toBeTruthy();
|
||||
|
||||
// Click and wait for the decide POST to finish (204) BEFORE leaving the page. `click()` only
|
||||
// dispatches the request; navigating away immediately cancels it in flight (nginx logs a 499) and
|
||||
// the decision never reaches the domain — so the registration would stay INGEDIEND.
|
||||
const decided = page.waitForResponse(
|
||||
(r) =>
|
||||
r.url().includes(`/behandel/registrations/${reference}/decide`) &&
|
||||
r.request().method() === 'POST',
|
||||
);
|
||||
await goedkeuren.click();
|
||||
expect((await decided).status()).toBe(204);
|
||||
const approve = await request.post(`http://domain:8080/registrations/${reference}/approve`);
|
||||
expect(approve.status()).toBe(204);
|
||||
|
||||
// The approval flows back to the projection; back on the openbaar register *our* row (matched by
|
||||
// its reference) now shows INGESCHREVEN.
|
||||
await page.goto('http://openbaar/');
|
||||
// The approval flows back to the projection; the openbaar register now shows *our* row (matched by
|
||||
// its reference) as INGESCHREVEN.
|
||||
await expect
|
||||
.poll(async () => {
|
||||
await page.reload();
|
||||
|
||||
Reference in New Issue
Block a user